pandorga 1.2.1

data/functions/api/studio/_lib/blocks.js

@@ -0,0 +1,156 @@
+/**
+ * Paragraph/block chunking for Studio Refine.
+ * Large selections get local patches per block; absolute offsets are remapped after.
+ */
+
+const DEFAULT_TARGET = 1_800;
+const DEFAULT_MAX = 2_400;
+
+/**
+ * Split markdown into contiguous blocks with absolute offsets into `text`.
+ * Breaks on blank lines (separators stay with the preceding block); merges small
+ * siblings up to targetChars without exceeding maxChars unless one segment is larger.
+ *
+ * @param {string} text
+ * @param {{ targetChars?: number, maxChars?: number }} [opts]
+ * @returns {{ index: number, start: number, end: number, text: string }[]}
+ */
+export function splitIntoBlocks(text, opts = {}) {
+  const targetChars = opts.targetChars ?? DEFAULT_TARGET;
+  const maxChars = opts.maxChars ?? DEFAULT_MAX;
+  const src = typeof text === "string" ? text : "";
+  if (!src) return [];
+
+  const chunks = src.split(/(\n{2,})/);
+  const segments = [];
+  let pos = 0;
+  for (const piece of chunks) {
+    if (!piece) continue;
+    const next = pos + piece.length;
+    if (/^\n{2,}$/.test(piece)) {
+      if (segments.length) {
+        const prev = segments[segments.length - 1];
+        prev.end = next;
+        prev.text = src.slice(prev.start, prev.end);
+      } else {
+        segments.push({ start: pos, end: next, text: piece });
+      }
+    } else {
+      segments.push({ start: pos, end: next, text: piece });
+    }
+    pos = next;
+  }
+  if (!segments.length) {
+    return [{ index: 0, start: 0, end: src.length, text: src }];
+  }
+
+  const merged = [];
+  let buf = null;
+  for (const seg of segments) {
+    if (!buf) {
+      buf = { start: seg.start, end: seg.end, text: seg.text };
+      continue;
+    }
+    const combinedLen = buf.end - buf.start + (seg.end - seg.start);
+    if (buf.text.trim().length < targetChars && combinedLen <= maxChars) {
+      buf.end = seg.end;
+      buf.text = src.slice(buf.start, buf.end);
+    } else {
+      merged.push(buf);
+      buf = { start: seg.start, end: seg.end, text: seg.text };
+    }
+  }
+  if (buf) merged.push(buf);
+
+  return merged.map((b, index) => ({
+    index,
+    start: b.start,
+    end: b.end,
+    text: b.text,
+  }));
+}
+
+/**
+ * Find a unique (or hint-disambiguated) occurrence of `needle` in `haystack`.
+ * @param {string} haystack
+ * @param {string} needle
+ * @param {number} [hint]
+ * @returns {{ start: number, end: number } | null}
+ */
+export function locateUnique(haystack, needle, hint = 0) {
+  if (!needle || typeof haystack !== "string") return null;
+  const h = Number.isInteger(hint) ? hint : 0;
+  if (h >= 0 && haystack.slice(h, h + needle.length) === needle) {
+    return { start: h, end: h + needle.length };
+  }
+  const hits = [];
+  let from = 0;
+  while (from <= haystack.length - needle.length) {
+    const i = haystack.indexOf(needle, from);
+    if (i === -1) break;
+    hits.push(i);
+    from = i + 1;
+  }
+  if (!hits.length) return null;
+  if (hits.length === 1) {
+    return { start: hits[0], end: hits[0] + needle.length };
+  }
+  let best = hits[0];
+  let bestDist = Math.abs(best - h);
+  for (const i of hits) {
+    const d = Math.abs(i - h);
+    if (d < bestDist) {
+      best = i;
+      bestDist = d;
+    }
+  }
+  return { start: best, end: best + needle.length };
+}
+
+/**
+ * Map block-scoped patches onto absolute offsets in the full work text.
+ * @param {{ index: number, start: number, end: number, text: string }[]} blocks
+ * @param {unknown[]} patches
+ * @returns {unknown[]}
+ */
+export function flattenBlockPatches(blocks, patches) {
+  const list = Array.isArray(patches) ? patches : [];
+  const byIndex = new Map(
+    (Array.isArray(blocks) ? blocks : []).map((b) => [b.index, b])
+  );
+  const out = [];
+  for (const raw of list) {
+    if (!raw || typeof raw !== "object") continue;
+    const blockIndex = Number(raw.block);
+    if (!Number.isInteger(blockIndex)) continue;
+    const block = byIndex.get(blockIndex);
+    if (!block) continue;
+    const original = String(raw.original ?? "");
+    const replacement = String(raw.replacement ?? "");
+    if (!original || replacement === original) continue;
+    const hint = Number.isInteger(Number(raw.start)) ? Number(raw.start) : 0;
+    const loc = locateUnique(block.text, original, hint);
+    if (!loc) continue;
+    out.push({
+      start: block.start + loc.start,
+      end: block.start + loc.end,
+      original,
+      replacement,
+      category: raw.category,
+      reason: raw.reason,
+    });
+  }
+  return out;
+}
+
+/**
+ * Format blocks for the Gemini user message.
+ * @param {{ index: number, text: string }[]} blocks
+ */
+export function formatBlocksForPrompt(blocks) {
+  const lines = ["blocks:"];
+  for (const b of blocks) {
+    lines.push(`[${b.index}]`, "<<<", b.text, ">>>");
+  }
+  return lines.join("\n");
+}

data/functions/api/studio/_lib/gemini.js

@@ -0,0 +1,62 @@
+/**
+ * Gemini generateContent client (Google AI Studio / Generative Language API).
+ * Spec: docs/features/studio-proof.md §5.
+ */
+
+/**
+ * @param {object} env
+ * @param {object} body — generateContent request payload
+ * @returns {Promise<{ patches: unknown[], model: string, rawText: string }>}
+ */
+export async function callGemini(env, body) {
+  const key = String(env.GEMINI_API_KEY || "").trim();
+  if (!key) {
+    const err = new Error("gemini_unconfigured");
+    err.code = "gemini_unconfigured";
+    throw err;
+  }
+  const model = String(env.GEMINI_MODEL || "gemini-2.5-flash").trim();
+  const url = `https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(model)}:generateContent?key=${encodeURIComponent(key)}`;
+
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const raw = await res.text();
+  if (!res.ok) {
+    const err = new Error(`gemini_http_${res.status}`);
+    err.code = "gemini_upstream";
+    err.status = res.status;
+    err.detail = raw.slice(0, 400);
+    throw err;
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    const err = new Error("gemini_bad_json");
+    err.code = "gemini_upstream";
+    throw err;
+  }
+
+  const text =
+    parsed?.candidates?.[0]?.content?.parts?.map((p) => p.text || "").join("") ||
+    "";
+  let payload;
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    const err = new Error("gemini_schema_json");
+    err.code = "gemini_upstream";
+    err.detail = text.slice(0, 400);
+    throw err;
+  }
+
+  return {
+    patches: Array.isArray(payload.patches) ? payload.patches : [],
+    model,
+    rawText: text,
+  };
+}

data/functions/api/studio/_lib/github.js

@@ -0,0 +1,278 @@
+/**
+ * GitHub Contents API helpers. PAT stays server-side (AC-STU-09).
+ */
+
+function repoParts(env) {
+  const full = String(env.GITHUB_REPO || "").trim();
+  if (!full) throw new Error("GITHUB_REPO is required (owner/name)");
+  const [owner, repo] = full.split("/");
+  if (!owner || !repo) throw new Error("GITHUB_REPO must be owner/name");
+  return { owner, repo };
+}
+
+/**
+ * GitHub Contents failures used to surface as `{ error: "server_error" }` with
+ * the status buried after a colon. A phone toolbar ellipsizes that to
+ * "server_err…", so the code and the sentence have to travel separately.
+ *
+ * Primary and secondary rate limits are 403 or 429. A bare 403 is also how
+ * GitHub reports a bad token, so only a rate-limit sentence counts.
+ */
+export function isGithubRateLimit(status, body) {
+  if (status === 429) return true;
+  if (status !== 403) return false;
+  const lower = String(body || "").toLowerCase();
+  return (
+    lower.includes("rate limit") ||
+    lower.includes("secondary rate") ||
+    lower.includes("abuse detection")
+  );
+}
+
+/**
+ * @param {string} op
+ * @param {number} status
+ * @param {string} text
+ * @returns {{ message: string, code: string, status: number }}
+ */
+export function classifyGithubFailure(op, status, text) {
+  const conflict = status === 409;
+  if (conflict) {
+    return {
+      message:
+        "This file changed on GitHub since Studio opened it. Reload it, then save again.",
+      code: "conflict",
+      status,
+    };
+  }
+  if (isGithubRateLimit(status, text)) {
+    return {
+      message: "GitHub is rate-limiting Studio. Wait a minute, then save again.",
+      code: "github_rate_limited",
+      status: 429,
+    };
+  }
+  return {
+    message: `GitHub ${op} failed (${status}).`,
+    code: "github_error",
+    status: status >= 400 && status < 600 ? status : 502,
+  };
+}
+
+function githubFail(op, res, text) {
+  const classified = classifyGithubFailure(op, res.status, text);
+  const err = new Error(classified.message);
+  err.status = classified.status;
+  err.code = classified.code;
+  err.detail = String(text || "").slice(0, 400);
+  return err;
+}
+
+async function gh(env, path, init = {}) {
+  const token = env.GITHUB_TOKEN;
+  if (!token) {
+    const err = new Error("GITHUB_TOKEN not configured");
+    err.status = 503;
+    err.code = "github_unconfigured";
+    throw err;
+  }
+  const { owner, repo } = repoParts(env);
+  const url = `https://api.github.com/repos/${owner}/${repo}${path}`;
+  const res = await fetch(url, {
+    ...init,
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "website-studio",
+      ...(init.headers || {}),
+    },
+  });
+  return res;
+}
+
+export async function getFile(env, path) {
+  const res = await gh(env, `/contents/${path}?ref=main`);
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw githubFail("get", res, await res.text());
+  }
+  const json = await res.json();
+  if (json.type !== "file" || !json.content) {
+    const err = new Error("not a file");
+    err.status = 400;
+    err.code = "not_a_file";
+    throw err;
+  }
+  const content = new TextDecoder("utf-8").decode(
+    Uint8Array.from(atob(String(json.content).replace(/\n/g, "")), (c) =>
+      c.charCodeAt(0)
+    )
+  );
+  return { path, content, sha: json.sha, size: json.size };
+}
+
+export async function putFile(env, { path, content, message, sha }) {
+  const body = {
+    message: message || `studio: update ${path}`,
+    content: btoa(unescape(encodeURIComponent(content))),
+    branch: "main",
+  };
+  if (sha) body.sha = sha;
+  const res = await gh(env, `/contents/${path}`, {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) {
+    throw githubFail("put", res, await res.text());
+  }
+  return res.json();
+}
+
+/**
+ * Put a binary file. `contentBase64` is already base64 of raw bytes
+ * (GitHub Contents API create/update limit: 100 MB; Studio caps lower).
+ */
+export async function putBinaryFile(env, { path, contentBase64, message, sha }) {
+  const body = {
+    message: message || `studio: upload ${path}`,
+    content: contentBase64,
+    branch: "main",
+  };
+  if (sha) body.sha = sha;
+  const res = await gh(env, `/contents/${path}`, {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) {
+    throw githubFail("put", res, await res.text());
+  }
+  return res.json();
+}
+
+/** Metadata only — safe for binary paths (no UTF-8 decode). */
+export async function getFileMeta(env, path) {
+  const res = await gh(env, `/contents/${path}?ref=main`);
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw githubFail("get", res, await res.text());
+  }
+  const json = await res.json();
+  return {
+    path,
+    sha: json.sha || null,
+    size: json.size || 0,
+    type: json.type || null,
+  };
+}
+
+/** List directory entries (files and dirs). */
+export async function listEntries(env, dirPath) {
+  const res = await gh(env, `/contents/${dirPath}?ref=main`);
+  if (res.status === 404) return [];
+  if (!res.ok) {
+    throw githubFail("list", res, await res.text());
+  }
+  const json = await res.json();
+  if (!Array.isArray(json)) return [];
+  return json
+    .filter((e) => e.type === "file" || e.type === "dir")
+    .map((e) => ({
+      name: e.name,
+      path: e.path,
+      sha: e.sha,
+      size: e.size || 0,
+      type: e.type === "dir" ? "dir" : "file",
+    }));
+}
+
+export async function listDir(env, dirPath) {
+  const entries = await listEntries(env, dirPath);
+  return entries.filter((e) => e.type === "file");
+}
+
+/** Very small front-matter peek for tree listings (title/date/thumbnail + list meta). */
+export function peekMeta(raw) {
+  const empty = {
+    title: null,
+    date: null,
+    start_date: null,
+    end_date: null,
+    start: null,
+    end: null,
+    thumbnail: null,
+    key: null,
+    published: null,
+    language: null,
+    category: null,
+    type: null,
+    company: null,
+    status: null,
+    engagement: null,
+    tags: null,
+  };
+  const text = String(raw || "");
+  if (!text.startsWith("---")) return empty;
+  const fmEnd = text.indexOf("\n---", 3);
+  if (fmEnd < 0) return empty;
+  const fm = text.slice(3, fmEnd + 1);
+  const grab = (name) => {
+    const re = new RegExp(`^${name}:\\s*(.+)$`, "m");
+    const m = fm.match(re);
+    if (!m) return null;
+    let v = m[1].trim();
+    if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+      v = v.slice(1, -1);
+    }
+    return v;
+  };
+  /** Full tag list from inline `[a, b]` or a YAML block list. */
+  const grabTags = () => {
+    const clean = (s) => String(s || "").trim().replace(/^["']|["']$/g, "");
+    const inline = fm.match(/^tags:\s*\[([^\]]*)\]/m);
+    if (inline) {
+      const tags = inline[1]
+        .split(",")
+        .map(clean)
+        .filter(Boolean);
+      return tags.length ? tags : null;
+    }
+    const block = fm.match(/^tags:\s*\n((?:[ \t]*-[ \t]*.+\n?)+)/m);
+    if (block) {
+      const tags = block[1]
+        .split("\n")
+        .map((line) => {
+          const m = line.match(/^[ \t]*-[ \t]*(.+)$/);
+          return m ? clean(m[1]) : "";
+        })
+        .filter(Boolean);
+      return tags.length ? tags : null;
+    }
+    return null;
+  };
+  const startDate = grab("start_date");
+  const endDate = grab("end_date");
+  const start = grab("start");
+  const end = grab("end");
+  return {
+    title: grab("title") || grab("product") || grab("project") || grab("name") || grab("position"),
+    // Collapsed start for sort; list meta uses start_date/end_date or start/end.
+    date: grab("date") || startDate || start,
+    start_date: startDate,
+    end_date: endDate,
+    start,
+    end,
+    thumbnail: grab("thumbnail"),
+    key: grab("key"),
+    published: grab("published"),
+    language: grab("language"),
+    category: grab("category"),
+    type: grab("type"),
+    company: grab("company"),
+    status: grab("status"),
+    engagement: grab("engagement"),
+    tags: grabTags(),
+  };
+}

data/functions/api/studio/_lib/guidelines.js

@@ -0,0 +1,143 @@
+/**
+ * Load guidelines/studio-proof/pack.json from R2 (S3-compatible).
+ * Spec: docs/features/studio-proof.md §6 (AC-PRF-08).
+ */
+
+const cache = {
+  bodySha: null,
+  pack: null,
+  loadedAt: 0,
+};
+const TTL_MS = 60 * 60 * 1000;
+
+/**
+ * Minimal AWS SigV4 for S3 GetObject (R2).
+ * @param {object} env
+ * @param {string} key — object key without leading slash
+ */
+async function signedGet(env, key) {
+  const accessKey = String(env.R2_ACCESS_KEY_ID || "").trim();
+  const secretKey = String(env.R2_SECRET_ACCESS_KEY || "").trim();
+  const endpoint = String(env.R2_ENDPOINT || "").replace(/\/$/, "");
+  const bucket = String(env.R2_BUCKET || "").trim();
+  if (!accessKey || !secretKey || !endpoint || !bucket) {
+    const err = new Error("r2_unconfigured");
+    err.code = "guidelines_unavailable";
+    throw err;
+  }
+
+  const url = new URL(endpoint);
+  const host = url.host;
+  const amzDate = new Date().toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const dateStamp = amzDate.slice(0, 8);
+  const region = String(env.R2_REGION || "auto");
+  const service = "s3";
+  const canonicalUri = `/${bucket}/${key.split("/").map(encodeURIComponent).join("/")}`;
+  const payloadHash = await sha256Hex("");
+  const canonicalHeaders = `host:${host}\nx-amz-content-sha256:${payloadHash}\nx-amz-date:${amzDate}\n`;
+  const signedHeaders = "host;x-amz-content-sha256;x-amz-date";
+  const canonicalRequest = [
+    "GET",
+    canonicalUri,
+    "",
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join("\n");
+  const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    await sha256Hex(canonicalRequest),
+  ].join("\n");
+  const signingKey = await getSignatureKey(secretKey, dateStamp, region, service);
+  const signature = await hmacHex(signingKey, stringToSign);
+  const authorization = `AWS4-HMAC-SHA256 Credential=${accessKey}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const res = await fetch(`${endpoint}${canonicalUri}`, {
+    method: "GET",
+    headers: {
+      Host: host,
+      "x-amz-date": amzDate,
+      "x-amz-content-sha256": payloadHash,
+      Authorization: authorization,
+    },
+  });
+  if (res.status === 404) {
+    const err = new Error("pack_missing");
+    err.code = "guidelines_unavailable";
+    throw err;
+  }
+  if (!res.ok) {
+    const err = new Error(`r2_http_${res.status}`);
+    err.code = "guidelines_unavailable";
+    throw err;
+  }
+  return res.json();
+}
+
+async function sha256Hex(message) {
+  const data = new TextEncoder().encode(message);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return [...new Uint8Array(hash)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+async function hmac(key, message) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    typeof key === "string" ? new TextEncoder().encode(key) : key,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
+  return new Uint8Array(sig);
+}
+
+async function hmacHex(key, message) {
+  const sig = await hmac(key, message);
+  return [...sig].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+async function getSignatureKey(secretKey, dateStamp, region, service) {
+  const kDate = await hmac(`AWS4${secretKey}`, dateStamp);
+  const kRegion = await hmac(kDate, region);
+  const kService = await hmac(kRegion, service);
+  return hmac(kService, "aws4_request");
+}
+
+/**
+ * @param {object} env
+ * @returns {Promise<{ body_markdown: string, body_sha256: string }>}
+ */
+export async function loadGuidelinesPack(env) {
+  // Test / local override without R2.
+  if (env.GUIDELINES_PACK_JSON) {
+    const pack = JSON.parse(String(env.GUIDELINES_PACK_JSON));
+    return pack;
+  }
+
+  const now = Date.now();
+  if (cache.pack && now - cache.loadedAt < TTL_MS) {
+    return cache.pack;
+  }
+
+  const pack = await signedGet(env, "guidelines/studio-proof/pack.json");
+  if (!pack?.body_markdown || !pack?.body_sha256) {
+    const err = new Error("pack_invalid");
+    err.code = "guidelines_unavailable";
+    throw err;
+  }
+  cache.pack = pack;
+  cache.bodySha = pack.body_sha256;
+  cache.loadedAt = now;
+  return pack;
+}
+
+/** @visibleForTesting */
+export function clearGuidelinesCache() {
+  cache.pack = null;
+  cache.bodySha = null;
+  cache.loadedAt = 0;
+}